# cPanel
/home/youracct/
  ├── .env ← private
  └── public_html/
      └── canibreakit.com/

// php/bootstrap/env.php
$f=dirname(__DIR__,3).'/.env';
if(is_file($f)){
  foreach(file($f) as $line){
    $line=trim($line);
    if(!$line||$line[0]==='#')continue;
    [$k,$v]=explode('=',$line,2)+['',''];
    $_ENV[trim($k)]=trim($v);
  }}

require __DIR__.'/../bootstrap/env.php';
$host=$_ENV['DB_HOST']??'localhost';
$db=$_ENV['DB_NAME'];
$user=$_ENV['DB_USER'];
$pass=$_ENV['DB_PASS'];
// remove hardcoded lines

// login_handler.php
$tok=$body['_csrf']??'';
if(!hash_equals(
  $_SESSION['csrf_token']??'',
  (string)$tok
)){http_response_code(403);exit;}

# .htaccess
<FilesMatch "^\.env">
  Require all denied
</FilesMatch>